fix(admin): gate whitelabel on entitlement and emit detach audits post-commit

The Admin whitelabel PATCH skipped the entitlement check the settings UI runs,
so an admin key could set branding the product had not granted the org.

detachOrganizationWorkspacesTx also wrote its audit rows inside the caller's
transaction, contradicting its own doc comment — a rolled-back delete would have
left audit history describing detachments that never happened. It now returns
the rows and callers emit them after commit.

Author: icecrasher321

apps/sim/app/api/v1/admin/organizations/[id]/route.test.ts

@@ -22,6 +22,7 @@ vi.mock('@/app/api/v1/admin/auth', () => ({
 
 vi.mock('@sim/audit', () => ({
   recordAudit: vi.fn(),
+  recordAuditBatch: vi.fn(),
   AuditAction: {
     ORGANIZATION_UPDATED: 'organization.updated',
     ORGANIZATION_DELETED: 'organization.deleted',
@@ -57,6 +58,8 @@ describe('admin organization DELETE', () => {
     mockDetachOrganizationWorkspacesTx.mockResolvedValue({
       detachedWorkspaceIds: ['ws-1', 'ws-2'],
       billedAccountUserId: 'user-1',
+      /** Returned rather than written, so the caller can emit them post-commit. */
+      auditEntries: [],
     })
     mockDelete.mockClear()
   })

apps/sim/app/api/v1/admin/organizations/[id]/route.ts

@@ -30,7 +30,7 @@
  * Response: AdminSingleResponse<{ success, organizationId, slug, membersRemoved, workspacesDetached }>
  */
 
-import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { AuditAction, AuditResourceType, recordAudit, recordAuditBatch } from '@sim/audit'
 import { db } from '@sim/db'
 import { member, organization, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
@@ -292,12 +292,14 @@ export const DELETE = withRouteHandler(
        * leave workspaces re-billed to their owners while the organization,
        * its members, and its settings survived a failed delete.
        */
-      const { detachedWorkspaceIds } = await db.transaction(async (tx) => {
+      const { detachedWorkspaceIds, auditEntries } = await db.transaction(async (tx) => {
         const detached = await detachOrganizationWorkspacesTx(tx, organizationId)
         await tx.delete(organization).where(eq(organization.id, organizationId))
         return detached
       })
 
+      recordAuditBatch(auditEntries)
+
       logger.info(`Admin API: Deleted organization ${organizationId}`, {
         slug: existing.slug,
         membersRemoved: memberCountRow?.value ?? 0,

apps/sim/app/api/v1/admin/organizations/[id]/whitelabel/route.ts

@@ -18,12 +18,15 @@ import { createLogger } from '@sim/logger'
 import { eq } from 'drizzle-orm'
 import { adminV1UpdateOrganizationWhitelabelContract } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
+import { isOrganizationFeatureEntitled } from '@/lib/billing/core/subscription'
 import type { OrganizationWhitelabelSettings } from '@/lib/branding/types'
+import { isBillingEnabled, isWhitelabelingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   adminInvalidJsonResponse,
   adminValidationErrorResponse,
+  forbiddenResponse,
   internalErrorResponse,
   notFoundResponse,
   singleResponse,
@@ -62,6 +65,20 @@ export const PATCH = withRouteHandler(
         return notFoundResponse('Organization')
       }
 
+      /**
+       * Same entitlement gate the settings UI applies. An admin key
+       * authenticates an operator, not an entitlement, so without this it would
+       * be a way to set branding the product has not granted this organization.
+       */
+      const entitled = await isOrganizationFeatureEntitled(organizationId, isWhitelabelingEnabled)
+      if (!entitled) {
+        return forbiddenResponse(
+          isBillingEnabled
+            ? 'Whitelabeling is available on Enterprise plans only'
+            : 'Whitelabeling is disabled. Set ENTERPRISE_ENABLED or WHITELABELING_ENABLED to enable it.'
+        )
+      }
+
       const merged: OrganizationWhitelabelSettings = { ...(existing.whitelabelSettings ?? {}) }
       for (const key of Object.keys(incoming) as Array<keyof typeof incoming>) {
         const value = incoming[key]

apps/sim/lib/workspaces/organization-workspaces.ts

@@ -32,6 +32,8 @@ export interface AttachOwnedWorkspacesToOrganizationTxResult
 export interface DetachOrganizationWorkspacesResult {
   detachedWorkspaceIds: string[]
   billedAccountUserId: string | null
+  /** Emit with `recordAuditBatch` once the surrounding transaction has committed. */
+  auditEntries: Parameters<typeof recordAuditBatch>[0]
 }
 
 export class WorkspaceOrganizationMembershipConflictError extends Error {
@@ -336,7 +338,9 @@ export async function attachOwnedWorkspacesToOrganizationTx(
 export async function detachOrganizationWorkspaces(
   organizationId: string
 ): Promise<DetachOrganizationWorkspacesResult> {
-  return db.transaction((tx) => detachOrganizationWorkspacesTx(tx, organizationId))
+  const result = await db.transaction((tx) => detachOrganizationWorkspacesTx(tx, organizationId))
+  recordAuditBatch(result.auditEntries)
+  return result
 }
 
 /**
@@ -345,8 +349,10 @@ export async function detachOrganizationWorkspaces(
  * detach that committed on its own would leave workspaces re-billed while the
  * organization it was meant to empty still exists.
  *
- * Audit rows are emitted by the caller after commit; `recordAuditBatch` is
- * fire-and-forget and must not describe a transaction that may still roll back.
+ * Returns its audit rows in `auditEntries` rather than writing them. Callers
+ * pass them to `recordAuditBatch` only after their transaction commits: the
+ * write is fire-and-forget, so emitting it here would leave audit history
+ * describing detachments that a later rollback undid.
  */
 export async function detachOrganizationWorkspacesTx(
   tx: DbOrTx,
@@ -427,14 +433,23 @@ export async function detachOrganizationWorkspacesTx(
     return [...workspaceIds].sort()
   })()
 
+  logger.info('Detached organization workspaces', {
+    organizationId,
+    detachedWorkspaceCount: detachedWorkspaceIds.length,
+    billedAccountUserId: organizationOwnerId,
+  })
+
   const workspacesById = new Map(
     organizationWorkspaces.map((organizationWorkspace) => [
       organizationWorkspace.id,
       organizationWorkspace,
     ])
   )
-  recordAuditBatch(
-    detachedWorkspaceIds.map((detachedWorkspaceId) => {
+
+  return {
+    detachedWorkspaceIds,
+    billedAccountUserId: organizationOwnerId,
+    auditEntries: detachedWorkspaceIds.map((detachedWorkspaceId) => {
       const detachedWorkspace = workspacesById.get(detachedWorkspaceId)
       return {
         workspaceId: detachedWorkspaceId,
@@ -450,17 +465,6 @@ export async function detachOrganizationWorkspacesTx(
           newBilledAccountUserId: organizationOwnerId ?? detachedWorkspace?.ownerId ?? null,
         },
       }
-    })
-  )
-
-  logger.info('Detached organization workspaces', {
-    organizationId,
-    detachedWorkspaceCount: detachedWorkspaceIds.length,
-    billedAccountUserId: organizationOwnerId,
-  })
-
-  return {
-    detachedWorkspaceIds,
-    billedAccountUserId: organizationOwnerId,
+    }),
   }
 }